A wireless network security detection system and method based on abnormal traffic

Abstract

The application discloses a wireless network security detection system and method based on abnormal traffic. It relates to the technical field of network security, and the system comprises: a traffic collection and preprocessing module, which is used for real-time capturing of wireless network data packets of a target device and extraction of multi-dimensional traffic features in the wireless network data packets; an anomaly detection engine, which is used for abnormal behavior analysis based on the multi-dimensional traffic features, obtaining of an initial abnormal alarm and a corresponding abnormality degree; a physical verification module, which is used for collecting real-time environmental data of a space where the target device is located based on the initial abnormal alarm, cross verification of the initial abnormal alarm based on the real-time environmental data, and obtaining of a verification conclusion; and an active defense module, which is used for determining an abnormality level of the target device based on the abnormality degree and the verification conclusion, and adjusting a defense mode of the target device based on the abnormality level. The system can reduce the false detection rate of network security anomalies and improve the active defense capability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a wireless network security detection system and method based on abnormal traffic. Background Technology

[0002] With the widespread adoption of wireless networks, wireless communication technologies such as Wireless Fidelity (Wi-Fi), 5G, and the Internet of Things (IoT) have become crucial components of critical information infrastructure. However, the openness and broadcast nature of wireless networks exposes them to severe security threats. Traditional intrusion detection systems primarily rely on anomaly analysis based on network traffic characteristics, but these systems suffer from the following technical shortcomings in practical deployments: First, the false detection rate is high. The wireless network environment is dynamic and ever-changing. Normal events such as signal fluctuations, device roaming, and sudden traffic spikes are easily misjudged as attacks, resulting in a large number of invalid alarms.

[0003] Second, proactive defense carries significant risks. Existing mobile target defense technologies, such as dynamic (Internet Protocol, IP) obfuscation, and proactive remediation technologies, such as vulnerability masking, can interfere with normal business operations in the event of false detections, causing legitimate users to lose network access and experience session resets. For example, Chinese patent application CN120658435A discloses a network security management optimization method and system for non-regulated businesses.

[0004] Third, the detection dimensions are limited. Existing technologies are limited to the analysis of network data domains and lack evidence sources independent of the network to cross-verify the detection results, making it difficult to distinguish between real attacks and environmental noise. For example, the network traffic anomaly detection method and detection device disclosed in Chinese patent application CN101795215A.

[0005] Therefore, existing methods face problems such as high false alarm rates in network security detection, significant risks in proactive defense, and limited detection dimensions. Summary of the Invention

[0006] This invention provides a wireless network security detection system and method based on abnormal traffic, in order to solve the problems of high false alarm rate, high risk of active defense and single detection dimension in the existing network security detection.

[0007] According to one aspect of the present invention, a wireless network security detection system based on abnormal traffic is provided. The system includes: a traffic acquisition and preprocessing module, an anomaly detection engine, a physical verification module, and an active defense module; the anomaly detection engine is connected to the traffic acquisition and preprocessing module, the physical verification module, and the active defense module, respectively, and the physical verification module is connected to the active defense module. The traffic acquisition and preprocessing module is used to capture wireless network data packets of the target device in real time, extract multi-dimensional traffic features from the wireless network data packets, and send the multi-dimensional traffic features to the anomaly detection engine. The anomaly detection engine is used to perform abnormal behavior analysis based on the multi-dimensional traffic characteristics, obtain an initial anomaly alarm and the corresponding anomaly degree, send the initial anomaly alarm to the physical verification module, and send the anomaly degree to the active defense module. The physical verification module is used to collect real-time environmental data of the space where the target device is located based on the initial abnormal alarm, perform cross-verification on the initial abnormal alarm based on the real-time environmental data, obtain a verification conclusion, and send the verification conclusion to the active defense module. The active defense module is used to determine the anomaly level of the target device based on the anomaly degree and the verification conclusion, and to adjust the defense mode of the target device based on the anomaly level.

[0008] According to another aspect of the present invention, a wireless network security detection method based on abnormal traffic is provided, the method comprising: The traffic acquisition and preprocessing module captures wireless network data packets of the target device in real time and extracts multi-dimensional traffic features from the wireless network data packets. The anomaly detection engine performs anomaly behavior analysis based on the multi-dimensional traffic characteristics to obtain initial anomaly alarms and corresponding anomaly degrees. The physical verification module collects real-time environmental data of the space where the target device is located based on the initial abnormal alarm, and cross-verifies the initial abnormal alarm based on the real-time environmental data to obtain verification conclusions. The active defense module determines the anomaly level of the target device based on the anomaly degree and the verification conclusion, and adjusts the defense mode of the target device based on the anomaly level.

[0009] This invention discloses a wireless network security detection system and method based on abnormal traffic. The system includes: a traffic acquisition and preprocessing module, an anomaly detection engine, a physical verification module, and an active defense module. The anomaly detection engine is connected to the traffic acquisition and preprocessing module, the physical verification module, and the active defense module, respectively. The physical verification module is connected to the active defense module. The traffic acquisition and preprocessing module is used to capture wireless network data packets of a target device in real time, extract multi-dimensional traffic features from the wireless network data packets, and send the multi-dimensional traffic features to the anomaly detection engine. The anomaly detection engine is used to detect the multi-dimensional traffic features based on the traffic data packets. The system analyzes abnormal behavior based on traffic characteristics to obtain initial abnormal alarms and corresponding abnormality levels. The initial abnormal alarms are sent to the physical verification module, and the abnormality levels are sent to the proactive defense module. The physical verification module collects real-time environmental data of the target device's location based on the initial abnormal alarms, cross-verifies the initial abnormal alarms based on the real-time environmental data, obtains a verification conclusion, and sends the verification conclusion to the proactive defense module. The proactive defense module determines the abnormality level of the target device based on the abnormality level and the verification conclusion, and adjusts the target device's defense mode based on the abnormality level. By introducing the physical verification module, the system cross-verifies the collected environmental data with the anomalies detected by the anomaly detection engine, effectively reducing the false alarm rate. The proactive defense module can proactively defend based on the abnormality level, reducing the risk of proactive defense and solving the problems of high false alarm rates, high risks of proactive defense, and single detection dimensions in existing network security detection technologies.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a schematic diagram of a wireless network security detection system based on abnormal traffic, provided in Embodiment 1 of the present invention. Figure 2 This is a schematic diagram of a wireless network security detection process provided in an embodiment of the present invention; Figure 3This is a schematic diagram illustrating the defense principle of an active defense module provided in an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the generation of a false cover under an abnormal obfuscation defense mode, as provided in an embodiment of the present invention. Figure 5 A schematic diagram illustrating the defense principle of another active defense module provided in an embodiment of the present invention; Figure 6 This is a flowchart illustrating a method for monitoring abnormal network events, provided as an embodiment of the present invention. Figure 7 This is a flowchart illustrating a wireless network security detection method based on abnormal traffic, provided in Embodiment 2 of the present invention. Figure 8 This is a flowchart illustrating a wireless network security detection method based on abnormal traffic, provided in an embodiment of the present invention. Detailed Implementation

[0013] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention. It should be understood that the various steps described in the method embodiments of the present invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0014] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, any variations of the terms "comprising" and "having," etc., are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0017] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0018] Example 1 Figure 1 This is a schematic diagram of a wireless network security detection system based on abnormal traffic, provided in Embodiment 1 of the present invention. This method is applicable to situations where network security detection is performed on devices accessing a wireless network. Figure 1 As shown, the wireless network security detection system based on abnormal traffic provided in Embodiment 1 of the present invention includes: a traffic acquisition and preprocessing module 10, an anomaly detection engine 20, a physical verification module 30, and an active defense module 40; the anomaly detection engine 20 is connected to the traffic acquisition and preprocessing module 10, the physical verification module 30, and the active defense module 40 respectively, and the physical verification module 30 is connected to the active defense module 40. The traffic acquisition and preprocessing module 10 is used to capture wireless network data packets of the target device in real time, extract multi-dimensional traffic features from the wireless network data packets, and send the multi-dimensional traffic features to the anomaly detection engine 20. Anomaly detection engine 20 is used to perform abnormal behavior analysis based on the multi-dimensional traffic characteristics, obtain initial anomaly alarms and corresponding anomaly degrees, and send the initial anomaly alarms to the physical verification module 30 and the anomaly degrees to the active defense module 40. The physical verification module 30 is used to collect real-time environmental data of the space where the corresponding target device is located based on the initial abnormal alarm, perform cross-verification on the initial abnormal alarm based on the real-time environmental data, obtain a verification conclusion, and send the verification conclusion to the active defense module 40. The active defense module 40 is used to determine the anomaly level of the target device based on the anomaly degree and the verification conclusion, and to adjust the defense mode of the target device based on the anomaly level.

[0019] The traffic acquisition and preprocessing module 10 can be a device that collects and preprocesses traffic data from the target device, and the traffic data can be wireless network data packets. The target device can be the device that needs to be monitored. The anomaly detection engine 20 can be a device that detects whether there are anomalies in the wireless network data packets. The physical verification module 30 can be a module that cross-verifies the detected anomalies by combining environmental data. The proactive defense module 40 can be a module that proactively adjusts the defense method based on the detection results. The wireless network data packets can be data frames transmitted through wireless communication protocols, and the wireless network data packets can contain data transmitted between the target device and the wireless network or other devices. The multi-dimensional traffic characteristics can be multiple quantitative indicators extracted from the wireless network data packets that can reflect the communication behavior characteristics of the target device. The initial anomaly alarm can be an alarm message for network anomaly events of the target device. The anomaly degree can refer to the degree of anomaly of the network anomaly events of the target device. The real-time environmental data can be the actual environmental information related to the environment in which the target device is located. The verification conclusion can be the verification result of whether the initial anomaly alarm is credible, and the verification conclusion can include verification pass and verification failure. Verification pass can indicate that the traffic of the target device is confirmed to be abnormal and that there is a network attack; verification failure indicates that the traffic is not abnormal and the initial alarm issued by the anomaly detection engine is a false alarm. Anomaly level can refer to the classification level of network anomalies. In this embodiment of the invention, anomaly levels can be divided into low-level anomaly, medium-level anomaly, and high-level anomaly. Defense mode can refer to the mode of preventing network attacks. For example, defense modes can include anomaly obfuscation defense mode and normal obfuscation defense mode. Anomaly obfuscation defense mode can refer to a mode that sends obfuscated data at a higher frequency, while normal obfuscation defense mode can refer to a mode that sends obfuscated data at a lower frequency. For example, normal obfuscation defense mode can be activated when verification fails.

[0020] In this embodiment, the anomaly detection engine 20 can be connected to the traffic acquisition and preprocessing module 10, the physical verification module 30, and the proactive defense module 40, respectively. The physical verification module 30 can be connected to the proactive defense module 40. The traffic acquisition and preprocessing module 10 can be deployed on the wireless network access side to capture wireless network data packets of the target device in real time, parse and extract multi-dimensional traffic features. The anomaly detection engine 20 can perform abnormal behavior analysis based on multi-dimensional traffic features, generate initial anomaly alarms and corresponding anomaly degrees. The physical verification module 30 can respond to the initial anomaly alarm, collect real-time environmental data of the physical space where the target device is located, and perform cross-domain cross-verification of the initial anomaly alarm in combination with the real-time environmental data, and output verification conclusions. The proactive defense module 40 can determine the anomaly level of the target device based on the anomaly degree and verification conclusions, and adjust the defense mode of the target device based on the anomaly level.

[0021] Figure 2 This is a schematic diagram of a wireless network security detection process provided by an embodiment of the present invention, such as... Figure 2 As shown, physical cross-validation can be used to determine the accuracy of initial anomaly alarms, which can effectively reduce the false alarm rate. By setting up the proactive defense module, proactive defense can be carried out against highly abnormal situations, and vulnerabilities can be repaired in advance.

[0022] This invention provides a wireless network security detection system based on abnormal traffic, comprising: a traffic acquisition and preprocessing module, an anomaly detection engine, a physical verification module, and an active defense module; the anomaly detection engine is connected to the traffic acquisition and preprocessing module, the physical verification module, and the active defense module, respectively, and the physical verification module is connected to the active defense module; the traffic acquisition and preprocessing module is used to capture wireless network data packets of a target device in real time, extract multi-dimensional traffic features from the wireless network data packets, and send the multi-dimensional traffic features to the anomaly detection engine; the anomaly detection engine is used to detect the multi-dimensional traffic features based on the... Traffic characteristics are analyzed to identify abnormal behavior, resulting in initial anomaly alarms and corresponding anomaly levels. The initial anomaly alarms are sent to the physical verification module, and the anomaly levels are sent to the proactive defense module. The physical verification module collects real-time environmental data of the target device's location based on the initial anomaly alarm, cross-verifies the initial anomaly alarm using this data, obtains a verification conclusion, and sends this conclusion to the proactive defense module. The proactive defense module determines the anomaly level of the target device based on the anomaly level and the verification conclusion, and adjusts the target device's defense mode accordingly. By introducing a physical verification module to cross-verify collected environmental data with anomalies detected by the anomaly detection engine, this system effectively reduces false alarm rates. The proactive defense module can proactively defend based on anomaly levels, reducing the risks associated with proactive defense and addressing the problems of high false alarm rates, significant risks in proactive defense, and limited detection dimensions in existing network security detection technologies.

[0023] Based on the above embodiments, modified embodiments of the above embodiments are proposed. It should be noted that, in order to keep the description brief, only the differences from the above embodiments are described in the modified embodiments.

[0024] In one embodiment, the physical verification module 30 includes a sensor array and a dynamic association unit, wherein the sensor array is connected to the dynamic association unit; the sensor array is used to collect real-time environmental data of the space where the target device corresponding to the initial abnormal alarm is located, and send the real-time environmental data to the dynamic association unit; the dynamic association unit is used to perform cross-validation on the initial abnormal alarm based on the real-time environmental data and a preset dynamic association rule base to obtain a verification conclusion; the dynamic association rule base includes the correspondence between network abnormal event types and environmental data.

[0025] The sensor array can be an array of multiple sensors, which may include at least one of the following: infrared array sensors, accelerometers, environmental noise sensors, access control system interfaces, or power consumption sensors. All sensors can have encrypted data transmission, anti-tampering, and authentication functions. The dynamic association rule base can refer to a database that stores the correspondence between the types of network anomalies and environmental data.

[0026] In this embodiment, the physical verification module 30 may include a sensor array and a dynamic association unit, with the sensor array connected to the dynamic association unit. The sensor array can collect real-time environmental data of the space where the target device corresponding to the initial abnormal alarm is located, and send the real-time environmental data to the dynamic association unit; the dynamic association unit can perform cross-verification of the initial abnormal alarm based on the real-time environmental data and a preset dynamic association rule base to obtain a verification conclusion.

[0027] The real-time environmental data collected by the sensors in this embodiment of the invention can also be synchronized with the time of network anomalies using a timestamp synchronization mechanism and blockchain evidence verification. This ensures the accuracy of the time alignment with network anomalies and prevents data tampering throughout the entire process from collection and transmission to storage. This effectively ensures the high accuracy of the traffic anomaly results after cross-verification by the physical verification module and significantly reduces the impact of false alarms on the normal use of user equipment caused by accidental activation of active defense.

[0028] In one embodiment, the dynamic association unit includes a time synchronization unit and a verification output unit; The time synchronization unit is used to align the initial abnormal alarm and the real-time environmental data with timestamps, and send the aligned initial abnormal alarm and real-time environmental data to the verification output unit. The verification output unit is used to verify whether the real-time environmental data collected by the sensor array has been tampered with; if not, it performs cross-verification on the aligned initial abnormal alarm based on the aligned real-time environmental data and the preset dynamic association rule base to obtain a verification conclusion.

[0029] In this embodiment, the dynamic association unit may include a time synchronization unit and a verification output unit, and the time synchronization unit may be connected to the verification output unit. The time synchronization unit can align the timestamp of the network anomaly event in the initial anomaly alarm with the timestamp of the real-time environmental data. The verification output unit can dynamically associate the rule base and the real-time environmental data to determine whether the initial anomaly alarm has been tampered with and output a verification conclusion. The dynamic association rule base stores the correspondence between network anomaly event types and environmental data. For example, rule 001 may be set as follows: if a "data theft" alarm is detected and the environmental data detected by the infrared sensor shows that there is no one in the corresponding device area, then the verification is successful.

[0030] In one embodiment, the proactive defense module 40 includes an anomaly classification unit and a dynamic obfuscation module, wherein the anomaly classification unit is connected to the dynamic obfuscation module; the anomaly classification unit is used to evaluate the anomaly level of the wireless network data packet based on the anomaly degree and the verification conclusion; when the anomaly level is moderate or high anomaly, the current defense mode is adjusted to an anomaly obfuscation defense mode; when the anomaly level is low anomaly, the current defense mode is adjusted to a normal obfuscation defense mode; the dynamic obfuscation module is used to generate obfuscated data based on the obfuscation data generation strategy corresponding to the current defense mode, and send the obfuscated data to the wireless access point so that the attacker can capture the obfuscated data.

[0031] In this context, a wireless access point can be a device that provides wireless network access services to the target device. An attacker can be a device that may have attacked the target device. Obfuscated data can be data that does not contain real device information. The obfuscation data generation strategy can be a rule for generating obfuscated data; different defense modes employ different obfuscation data generation strategies. For example, the obfuscation data generation strategy in the abnormal obfuscation defense mode can be to generate obfuscated data every first preset time interval (e.g., 30-90 seconds), while the obfuscation data generation strategy in the normal obfuscation defense mode can be to have an interval of no less than a second preset time interval (e.g., 10 minutes) between the generation of two consecutive obfuscated data.

[0032] In this embodiment, the active defense module 40 may include an anomaly classification unit and a dynamic obfuscation module, with the anomaly classification unit connected to the dynamic obfuscation module. The anomaly classification unit can assess the anomaly level of wireless network data packets based on the anomaly degree and verification conclusion. When the anomaly level is moderate or high, the current defense mode can be adjusted to an anomaly obfuscation defense mode; when the anomaly level is low, the current defense mode can be adjusted to a normal obfuscation defense mode. The anomaly obfuscation defense mode has a higher defense level than the normal obfuscation defense mode. The dynamic obfuscation module can generate obfuscated data based on the obfuscation data generation strategy corresponding to the current defense mode and distribute the obfuscated data to the wireless access point so that the attacker can capture the obfuscated data. For example, Figure 3 This is a schematic diagram illustrating the defense principle of an active defense module provided in an embodiment of the present invention, as shown below. Figure 3 As shown, during proactive defense, the dynamic obfuscation module can generate obfuscated data based on the current defense mode.

[0033] In one embodiment, the dynamic obfuscation module includes an obfuscation data generation unit, a software-defined networking (SDN) controller interface, and a synchronization management unit. The obfuscation data generation unit generates obfuscated data based on the obfuscation data generation strategy corresponding to the current defense mode and transmits the obfuscated data to the SDN controller interface. The SDN controller interface distributes the obfuscated data to wireless access points, enabling the wireless access points to update their flow table rules based on the obfuscated data. The synchronization management unit synchronizes the network access status based on the updated flow table rules, enabling other legitimate terminals to re-associate with the wireless network.

[0034] Flow table rules refer to the rules used to process incoming network packets. Updated flow table rules based on obfuscated data refer to dynamically adjusting flow table rules in the network based on the content, strategy, or transmission effect of obfuscated data. Network access status refers to the status of devices in the network establishing connections with the wireless network. Software Defined Networking (SDN) controller interfaces are the data interfaces through which the SDN controller communicates, controls, and exchanges data with different devices.

[0035] In this embodiment, the dynamic obfuscation module may include an obfuscation data generation unit, an SDN controller interface, and a synchronization management unit. The obfuscation data generation unit can generate obfuscated data based on the obfuscation data generation strategy corresponding to the current defense mode, and transmit the obfuscated data to the SDN controller interface. The SDN controller interface can then distribute the obfuscated data to the wireless access points, enabling the wireless access points to update their flow table rules based on the obfuscated data. Subsequently, the synchronization management unit can synchronize the network access status according to the updated flow table rules, allowing other legitimate terminals to re-associate with the wireless network.

[0036] The obfuscated data generation unit in this embodiment of the invention can generate unpredictable obfuscated parameter sequences, i.e., false obfuscated data, based on a chaotic mapping algorithm. This misleads the attacker, making it difficult for them to locate the real terminal device, thereby delaying the attack duration on the user device, providing sufficient time for the transmission of vaccine frames, increasing the probability of successful defense, and effectively reducing the risk of proactive defense. The SDN controller interface can distribute the obfuscated data to the wireless access point and synchronously update the flow table rules; the synchronization management unit can ensure that legitimate terminals can quickly re-associate after obfuscation transformation, thereby effectively reducing the impact of proactive defense on the normal use of legitimate terminal devices. Obfuscated data can include one or more of the following: dynamically changing the Basic Service Set Identifier (BSSID), channel, and IP address mappings of the wireless access point, which appears to the attacker as a doubling of the number of terminal devices. For example, Figure 4This is a schematic diagram illustrating the generation of a false cover under an anomaly obfuscation defense mode provided by an embodiment of the present invention, such as... Figure 4 As shown, by generating high-frequency and rapidly changing obfuscated data, multiple false cover can be created for the terminal device targeted by the attacker. Under the joint cover of multiple false cover, the data processing range of the attacker can be greatly expanded, making it difficult for the attacker to locate the terminal device targeted by the attacker, effectively ensuring the security of the terminal device and greatly reducing the probability of it being attacked by abnormal attacks.

[0037] In one embodiment, the active defense module 40 further includes a wireless epidemic prevention module, which is used to: when the anomaly level is highly abnormal, construct a vaccine frame based on the initial anomaly alarm and vulnerability feature library, and send the vaccine frame to the target device.

[0038] The vulnerability signature database can be a knowledge base that stores the signature information corresponding to known network vulnerabilities. The vaccine frame can be a data frame containing the characteristics of possible attack behaviors of the attacker, used to allow the target device to learn the attacker's attack characteristics in advance, enabling the target device to identify subsequent attack behaviors.

[0039] In this embodiment, the proactive defense module 40 may further include a wireless anti-vulnerability module. When the anomaly level is highly anomaly, the wireless anti-vulnerability module can construct a vaccine frame based on the initial anomaly alarm and vulnerability signature database, and send the vaccine frame to the target device. Since the false cover is generated specifically for the attacker, the wireless anti-vulnerability module can directly locate the target terminal device and push the vaccine frame accordingly. In contrast, the attacker needs to identify multiple false cover instances to locate the terminal device, significantly increasing the time required. Through the cooperation of the dynamic obfuscation module and the wireless anti-vulnerability module, by the time the attacker identifies the target terminal device, the attacker has already completed targeted vulnerability patching for that device, greatly improving the defense success rate.

[0040] For example, Figure 5 This is a schematic diagram illustrating the defense principle of another active defense module provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the anomaly classification unit can judge the traffic anomaly level based on the anomaly degree output by the anomaly detection engine and the verification conclusion output by the physical verification module. The anomaly level is divided into low anomaly, medium anomaly and high anomaly, and the degree of anomaly of the three levels gradually increases. The threshold for defining low anomaly, medium anomaly and high anomaly can be selected and set according to different actual needs.

[0041] If, after an initial anomaly alert, the physical verification module outputs "verification failed," it indicates no anomaly or a minor, negligible anomaly, classifying it as a low-level anomaly. Conversely, if the physical verification module outputs "verification successful," it indicates a genuine anomaly and a potential attack, classifying it as a medium or high-level anomaly. This distinction can be determined based on the anomaly severity score output by the anomaly detection engine. For instance, an anomaly severity threshold can be set; exceeding the threshold results in a high-level anomaly, while falling below it indicates a medium-level anomaly.

[0042] When the anomaly classification unit determines the traffic anomaly level to be moderate or high, the proactive defense module adjusts the defense mode to anomaly obfuscation defense mode; for low-level anomalies, it adjusts to normal obfuscation defense mode. In the case of moderate anomalies, after entering anomaly obfuscation defense mode, if the traffic anomaly fails to be eliminated as expected, it can automatically upgrade to high-level anomaly defense, that is, simultaneously trigger obfuscation defense and vaccine frame generation.

[0043] In one embodiment, the wireless epidemic prevention module includes a vaccine push unit, a vaccine frame construction engine, and a link layer injection driver; The vaccine push unit is used to search for the corresponding vaccine frame construction template from the vulnerability feature library according to the attack type identifier in the initial abnormal alarm, and send the vaccine frame construction template to the vaccine frame construction engine; the vulnerability feature library pre-stores vaccine frame construction templates corresponding to various wireless protocol vulnerabilities. The vaccine frame construction engine is used to generate a vaccine frame based on the vaccine frame construction template and the context information of the wireless network data packet, and to encapsulate the vaccine frame at the link layer to obtain the encapsulated vaccine frame, and to send the encapsulated vaccine frame to the link layer injection driver. The link layer injection driver is used to send the encapsulated vaccine frame to the wireless network driver layer, so that the wireless network driver layer can transmit the encapsulated vaccine frame to the target device.

[0044] The attack type identifier can be an identifier indicating the type of attack behavior of the attacker. The vaccine frame construction template can be a pre-set fixed template for generating vaccine frames. The vaccine frame construction template can include frame type (such as management frame or control frame), fields to be modified (such as frame control fields or specific information elements), filling rules (such as key sequence numbers or encryption parameters), and suggested expiration values. The vulnerability signature database can pre-store vaccine frame construction templates corresponding to various wireless protocol vulnerabilities. Wireless protocol vulnerabilities refer to security flaws in wireless communication protocols. Link layer encapsulation refers to the process of adding a link layer header and trailer to data packets, encapsulating them into data frames, and then transmitting them through the physical layer. Link layer encapsulation can encapsulate parameters such as the Media Access Control (MAC) address, source address, encryption parameters, and expiration flag of the terminal device with abnormal traffic. The expiration flag can be set according to actual conditions, such as 30 seconds, allowing the expiration management unit to determine whether the vaccine frame is still within its validity period. The wireless network driver layer can be the layer responsible for forwarding data frames.

[0045] In this embodiment, the wireless epidemic prevention module may include a vaccine push unit, a vaccine frame construction engine, and a link layer injection driver. The vaccine push unit can retrieve a vulnerability signature database based on the attack type identifier in the initial anomaly alarm, find the corresponding vaccine frame construction template from the database, and send the template to the vaccine frame construction engine. The vaccine frame construction engine can generate a specific vaccine frame based on the template and the context information of the wireless network data packets, and perform link layer encapsulation on the vaccine frame to obtain the encapsulated vaccine frame. The encapsulated vaccine frame is then sent to the link layer injection driver. The link layer injection driver can send the encapsulated vaccine frame to the wireless network driver layer, enabling the driver layer to transmit the encapsulated vaccine frame to the target device.

[0046] In one embodiment, the wireless epidemic prevention module further includes a timeliness management unit, which is used to: resend the vaccine frame if no new triggering instruction is received within the timeliness mark after the vaccine frame is sent; and regenerate and send the vaccine frame if a new triggering instruction is received within the timeliness mark.

[0047] The trigger command can refer to the command to regenerate the vaccine frame.

[0048] In this embodiment, the wireless epidemic prevention module may further include a timeliness management unit. The timeliness management unit can start timing after the vaccine frame is sent. If no new triggering instruction is received within the timeliness mark of the vaccine frame, the vaccine frame is automatically considered invalid and the vaccine frame is resent. If a new triggering instruction is received within the timeliness mark, it indicates that the attack is still ongoing within the validity period of the vaccine frame. A new vaccine frame is regenerated and sent. If the attack stops, the push is stopped to avoid interfering with normal communication.

[0049] In one embodiment, the anomaly detection engine 20 is further configured to: continuously monitor the wireless network data packets of the target device to obtain new wireless network data packets; determine whether the anomaly has disappeared based on the new wireless network data packets; and disconnect the target device from the wireless network if the anomaly has not disappeared and the number of times the vaccine frame is sent exceeds a preset threshold.

[0050] The preset threshold can be set according to the actual situation. The wireless network can be the network that the target device is connected to.

[0051] Figure 6 This is a flowchart illustrating a method for monitoring network anomalies, as provided in an embodiment of the present invention. Figure 6 As shown, the anomaly detection engine 20 can also continuously monitor the target device's wireless network data packets, obtain new wireless network data packets, and determine whether the anomaly has disappeared based on the new wireless network data packets (e.g., the attack characteristics such as abnormal key retransmission and deauthentication frames no longer appear). If it disappears, it indicates that the attack has been blocked, and this successful event can be recorded and the sample marked as an effective defense. If it does not disappear and the number of times the vaccine frame is sent exceeds a preset threshold (e.g., three times), the connection between the target device and the wireless network is disconnected, triggering the highest level of defense. If it does not disappear but the number of times the vaccine frame is sent does not exceed three times, it may indicate that the vaccine frame is ineffective (e.g., terminal incompatibility or attack bypass), and in this case, feedback can be given to the anomaly detection engine to adjust the strategy.

[0052] This invention, through cross-verification of traffic anomalies detected by a physical verification module and an anomaly detection engine, effectively ensures the existence of traffic anomalies, reduces the high false alarm rate, and thus mitigates the risks of proactive defense. The proactive defense module enables proactive defense against highly anomaly situations, simultaneously triggering a dynamic obfuscation module and a wireless anti-epidemic module. This generates obfuscated data to mislead attackers, delaying the actual attack. Simultaneously, while misleading the attacker, it sends a vaccine frame to the target terminal, proactively patching vulnerabilities before a network attack, thus blocking or intercepting the attack. Compared to existing technologies that require manual patch downloading after an attack, this system ensures the normal operation of terminal devices with minimal impact.

[0053] Example 2 Figure 7 This is a flowchart illustrating a wireless network security detection method based on abnormal traffic, provided in Embodiment 2 of the present invention. This method is applicable to situations involving network security detection of devices accessing a wireless network, and can be executed by a wireless network security detection system based on abnormal traffic. For details not covered in this embodiment, please refer to Embodiment 1.

[0054] like Figure 7 As shown in Embodiment 2 of the present invention, a wireless network security detection method based on abnormal traffic includes the following steps: S210. The wireless network data packets of the target device are captured in real time through the traffic acquisition and preprocessing module, and multi-dimensional traffic features in the wireless network data packets are extracted.

[0055] Wireless network data packets can be data frames transmitted via wireless communication protocols, and can contain data transmitted between the target device and the wireless network or other devices. Multi-dimensional traffic characteristics can be multiple quantitative indicators extracted from wireless network data packets that reflect the communication behavior characteristics of the target device.

[0056] In this embodiment, the wireless network data packets of the target device can be captured in real time through the traffic acquisition and preprocessing module, and multi-dimensional traffic features in the wireless network data packets can be extracted.

[0057] S220. The anomaly detection engine performs anomaly behavior analysis based on the multi-dimensional traffic characteristics to obtain the initial anomaly alarm and the corresponding anomaly degree.

[0058] The initial anomaly alarm can be an alarm message for an abnormal network event on the target device. The anomaly degree can refer to the degree of abnormality of the abnormal network event on the target device.

[0059] In this embodiment, an anomaly detection engine can perform abnormal behavior analysis based on multi-dimensional traffic characteristics to obtain initial anomaly alarms and corresponding anomaly degrees.

[0060] S230. The physical verification module collects real-time environmental data of the space where the target device is located based on the initial abnormal alarm, and performs cross-verification on the initial abnormal alarm based on the real-time environmental data to obtain a verification conclusion.

[0061] The real-time environmental data can be actual environmental information related to the environment in which the target device is located. The verification conclusion can be the result of verifying whether the initial abnormal alarm is reliable, and the verification conclusion can include verification passed and verification failed.

[0062] In this embodiment, the physical verification module can collect real-time environmental data of the space where the target device is located based on the initial abnormal alarm, and cross-verify the initial abnormal alarm based on the real-time environmental data to obtain the verification conclusion.

[0063] S240. The active defense module determines the anomaly level of the target device based on the anomaly degree and the verification conclusion, and adjusts the defense mode of the target device based on the anomaly level.

[0064] The anomaly level can refer to the classification level of network anomalies. In this embodiment of the invention, the anomaly level can be divided into low-level anomaly, medium-level anomaly, and high-level anomaly. The defense mode can refer to the mode of preventing network attacks. For example, the defense mode can include anomaly obfuscation defense mode and ordinary obfuscation defense mode.

[0065] In this embodiment, the anomaly level can be determined comprehensively based on the traffic anomaly degree and the verification conclusion, and the defense mode can be adjusted according to the anomaly level.

[0066] Embodiment 2 of this invention provides a wireless network security detection method based on abnormal traffic, comprising: capturing wireless network data packets of a target device in real time through a traffic acquisition and preprocessing module, and extracting multi-dimensional traffic features from the wireless network data packets; performing abnormal behavior analysis based on the multi-dimensional traffic features through an anomaly detection engine to obtain an initial anomaly alarm and the corresponding anomaly degree; collecting real-time environmental data of the space where the target device is located based on the initial anomaly alarm through a physical verification module, and cross-validating the initial anomaly alarm based on the real-time environmental data to obtain a verification conclusion; and determining the anomaly level of the target device based on the anomaly degree and the verification conclusion through an active defense module, and adjusting the defense mode of the target device based on the anomaly level. This method, by introducing a physical verification module to cross-validate the collected environmental data with the anomalies detected by the anomaly detection engine, can effectively reduce the false alarm rate; the active defense module can proactively defend based on the anomaly level, reducing the risk of active defense, and solving the problems of high false alarm rate, high risk of active defense, and single detection dimension in existing network security detection technologies.

[0067] In one embodiment, the physical verification module includes a sensor array and a dynamic correlation unit. The physical verification module collects real-time environmental data of the space where the target device is located based on the initial anomaly alarm, and performs cross-verification on the initial anomaly alarm based on the real-time environmental data to obtain a verification conclusion, including: Real-time environmental data of the space where the target device corresponding to the initial abnormal alarm is located is collected through a sensor array; The initial abnormal alarm is cross-validated by the dynamic association unit based on the real-time environmental data and the preset dynamic association rule base to obtain the verification conclusion; the dynamic association rule base includes the correspondence between network abnormal event types and environmental data.

[0068] In one embodiment, the dynamic association unit includes a time synchronization unit and a verification output unit. Based on the real-time environmental data and a preset dynamic association rule base, the dynamic association unit performs cross-validation on the initial anomaly alarm to obtain a verification conclusion. The dynamic association rule base includes the correspondence between network anomaly event types and environmental data, including: The initial anomaly alarm and the real-time environmental data are timestamped using a time synchronization unit to obtain the aligned initial anomaly alarm and real-time environmental data. The verification output unit verifies whether the real-time environmental data collected by the sensor array has been tampered with; if not, the aligned initial abnormal alarm is cross-verified based on the aligned real-time environmental data and the preset dynamic association rule base to obtain a verification conclusion.

[0069] In one embodiment, the proactive defense module includes an anomaly classification unit and a dynamic obfuscation module. The step of determining the anomaly level of the target device based on the anomaly degree and the verification conclusion, and adjusting the defense mode of the target device based on the anomaly level, includes: The anomaly classification unit evaluates the anomaly level of the wireless network data packet based on the anomaly degree and the verification conclusion; when the anomaly level is moderate or high anomaly, the current defense mode is adjusted to anomaly obfuscation defense mode; when the anomaly level is low anomaly, the current defense mode is adjusted to normal obfuscation defense mode. The dynamic obfuscation module generates obfuscated data based on the obfuscation data generation strategy corresponding to the current defense mode, and sends the obfuscated data to the wireless access point so that the attacker can capture the obfuscated data.

[0070] In one embodiment, the dynamic obfuscation module includes an obfuscated data generation unit, a software-defined network (SDN) controller interface, and a synchronization management unit; the step of generating obfuscated data based on the obfuscated data generation strategy corresponding to the current defense mode through the dynamic obfuscation module, and distributing the obfuscated data to the wireless access point so that the attacker can capture the obfuscated data, includes: Obfuscated data is generated by the obfuscation data generation unit based on the obfuscation data generation strategy corresponding to the current defense mode; The obfuscated data is sent to the wireless access point via the SDN controller interface, so that the wireless access point updates the flow table rules based on the obfuscated data. The synchronization management unit synchronizes the network access status based on the updated flow table rules, so that other legitimate terminals can re-associate with the wireless network.

[0071] In one embodiment, the proactive defense module further includes a wireless epidemic prevention module, and the method further includes: when the anomaly level is highly abnormal, the wireless epidemic prevention module constructs a vaccine frame based on the initial anomaly alarm and vulnerability feature library, and sends the vaccine frame to the target device.

[0072] In one embodiment, the wireless epidemic prevention module includes a vaccine push unit, a vaccine frame construction engine, and a link layer injection driver; the step of constructing a vaccine frame based on the initial anomaly alarm and vulnerability feature library, and sending the vaccine frame to the target device, includes: The vaccine delivery unit searches for the corresponding vaccine frame construction template from the vulnerability feature library based on the attack type identifier in the initial anomaly alarm; the vulnerability feature library pre-stores vaccine frame construction templates corresponding to various wireless protocol vulnerabilities. The vaccine frame is generated by the vaccine frame construction engine based on the vaccine frame construction template and the context information of the wireless network data packet. The vaccine frame is then encapsulated at the link layer to obtain the encapsulated vaccine frame. The encapsulated vaccine frame is sent to the wireless network driver layer via the link layer injection driver, so that the wireless network driver layer can transmit the encapsulated vaccine frame to the target device.

[0073] In one embodiment, the wireless epidemic prevention module further includes a timeliness management unit, and the method further includes: If no new triggering instruction is received within the time limit after the vaccine frame is sent by the time limit management unit, the vaccine frame is resent; if a new triggering instruction is received within the time limit, the vaccine frame is regenerated and sent.

[0074] In one embodiment, the method further includes: continuously monitoring the wireless network data packets of the target device through an anomaly detection engine to obtain new wireless network data packets; determining whether the anomaly has disappeared based on the new wireless network data packets; and disconnecting the target device from the wireless network if the anomaly has not disappeared and the number of times the vaccine frame is sent exceeds a preset threshold.

[0075] Based on the technical solutions of the above embodiments, this invention provides several specific implementation methods.

[0076] As one specific implementation method of this embodiment. Figure 8 This is a flowchart illustrating a wireless network security detection method based on abnormal traffic provided in an embodiment of the present invention, as shown below. Figure 8 As shown, the method includes: S1. Traffic Acquisition and Anomaly Detection: Capture wireless network data packets in real time, extract multi-dimensional traffic features, perform abnormal behavior analysis, and generate initial anomaly alarms and anomaly levels.

[0077] S2. Physical Domain Cross-Verification: In response to the initial anomaly alarm, the sensor array is activated to collect real-time environmental data of the physical space where the target device is located; the environmental data is matched with a preset dynamic association rule base, and the initial anomaly alarm is physically verified, outputting the verification conclusion. The physical domain cross-verification specifically includes: aligning the timestamp of the network anomaly event with the timestamp of the real-time environmental data; querying the corresponding physical verification rule from the dynamic association rule base according to the type of the initial anomaly alarm; comparing whether the real-time environmental data meets the physical verification rule; if it meets the rule, outputting "Verification passed"; if it does not meet the rule, outputting "Verification failed" and marking the initial anomaly alarm as a false alarm.

[0078] S3. Tiered Response Decision: Based on the traffic anomaly degree and verification conclusions, the anomaly level is determined comprehensively.

[0079] S4. Proactive Defense Execution: Adjust to different defense modes according to the anomaly level. In the anomaly obfuscation defense mode: when the traffic anomaly level is moderate, only the dynamic obfuscation module is triggered to generate obfuscated data; when the traffic anomaly level is high, both the dynamic obfuscation module and the wireless epidemic prevention module are triggered. While generating obfuscated data to mislead the attacker, a vaccine frame is sent to the target terminal to proactively fix the vulnerability before it is attacked by the network.

[0080] The method in this invention triggers only low-obfuscation data generation for low-level anomalies, avoiding resource waste; high obfuscation is activated for medium-level anomalies to dynamically disrupt the attack surface; and high-level anomalies simultaneously trigger high obfuscation and wireless security measures, proactively patching vulnerabilities by pushing vaccine frames while misleading attacks. This tiered mechanism achieves a dynamic balance between security protection and system overhead, preventing excessive defense from interfering with normal business operations. Furthermore, the wireless security module features timeliness management and effectiveness evaluation; it disconnects after three failures, ensuring controllable risks even in extreme situations and improving the overall accuracy of defense.

[0081] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0082] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A wireless network security detection system based on abnormal traffic, characterized in that, The system includes: a traffic acquisition and preprocessing module, an anomaly detection engine, a physical verification module, and an active defense module; the anomaly detection engine is connected to the traffic acquisition and preprocessing module, the physical verification module, and the active defense module, respectively, and the physical verification module is connected to the active defense module; The traffic acquisition and preprocessing module is used to capture wireless network data packets of the target device in real time, extract multi-dimensional traffic features from the wireless network data packets, and send the multi-dimensional traffic features to the anomaly detection engine. The anomaly detection engine is used to perform abnormal behavior analysis based on the multi-dimensional traffic characteristics, obtain an initial anomaly alarm and the corresponding anomaly degree, send the initial anomaly alarm to the physical verification module, and send the anomaly degree to the active defense module. The physical verification module is used to collect real-time environmental data of the space where the target device is located based on the initial abnormal alarm, perform cross-verification on the initial abnormal alarm based on the real-time environmental data, obtain a verification conclusion, and send the verification conclusion to the active defense module. The active defense module is used to determine the anomaly level of the target device based on the anomaly degree and the verification conclusion, and to adjust the defense mode of the target device based on the anomaly level.

2. The system according to claim 1, characterized in that, The physical verification module includes a sensor array and a dynamic correlation unit, wherein the sensor array is connected to the dynamic correlation unit. The sensor array is used to collect real-time environmental data of the space where the target device corresponding to the initial abnormal alarm is located, and send the real-time environmental data to the dynamic association unit. The dynamic association unit is used to cross-validate the initial abnormal alarm based on the real-time environmental data and the preset dynamic association rule base to obtain a verification conclusion. The dynamic association rule base includes the correspondence between network anomaly event types and environmental data.

3. The system according to claim 2, characterized in that, The dynamic association unit includes a time synchronization unit and a verification output unit; The time synchronization unit is used to align the initial abnormal alarm and the real-time environmental data with timestamps, and send the aligned initial abnormal alarm and real-time environmental data to the verification output unit. The verification output unit is used to verify whether the real-time environmental data collected by the sensor array has been tampered with; if not, it performs cross-verification on the aligned initial abnormal alarm based on the aligned real-time environmental data and the preset dynamic association rule base to obtain a verification conclusion.

4. The system according to claim 1, characterized in that, The active defense module includes an anomaly classification unit and a dynamic obfuscation module, wherein the anomaly classification unit is connected to the dynamic obfuscation module. The anomaly classification unit is used to evaluate the anomaly level of the wireless network data packet based on the anomaly degree and the verification conclusion; when the anomaly level is moderate or high anomaly, the current defense mode is adjusted to anomaly obfuscation defense mode; when the anomaly level is low anomaly, the current defense mode is adjusted to normal obfuscation defense mode. The dynamic obfuscation module is used to generate obfuscated data based on the obfuscation data generation strategy corresponding to the current defense mode, and to send the obfuscated data to the wireless access point so that the attacker can capture the obfuscated data.

5. The system according to claim 4, characterized in that, The dynamic obfuscation module includes an obfuscated data generation unit, a software-defined network (SDN) controller interface, and a synchronization management unit. The obfuscated data generation unit is used to generate obfuscated data based on the obfuscated data generation strategy corresponding to the current defense mode, and transmit the obfuscated data to the SDN controller interface. The SDN controller interface is used to send the obfuscated data to the wireless access point so that the wireless access point updates the flow table rules based on the obfuscated data; The synchronization management unit is used to synchronize the network access status based on the updated flow table rules, so that other legitimate terminals can re-associate with the wireless network.

6. The system according to claim 4, characterized in that, The active defense module also includes a wireless epidemic prevention module, which is used for: When the anomaly level is high anomaly, a vaccine frame is constructed based on the initial anomaly alarm and vulnerability feature library, and the vaccine frame is sent to the target device.

7. The system according to claim 6, characterized in that, The wireless epidemic prevention module includes a vaccine push unit, a vaccine frame construction engine, and a link layer injection driver. The vaccine push unit is used to search for the corresponding vaccine frame construction template from the vulnerability feature library according to the attack type identifier in the initial abnormal alarm, and send the vaccine frame construction template to the vaccine frame construction engine. The vulnerability signature database contains pre-stored vaccine frame construction templates corresponding to various wireless protocol vulnerabilities. The vaccine frame construction engine is used to generate a vaccine frame based on the vaccine frame construction template and the context information of the wireless network data packet, and to encapsulate the vaccine frame at the link layer to obtain the encapsulated vaccine frame, and to send the encapsulated vaccine frame to the link layer injection driver. The link layer injection driver is used to send the encapsulated vaccine frame to the wireless network driver layer, so that the wireless network driver layer can transmit the encapsulated vaccine frame to the target device.

8. The system according to claim 7, characterized in that, The wireless epidemic prevention module also includes a timeliness management unit, which is used for: If no new triggering instruction is received within the time limit after the vaccine frame is sent, the vaccine frame is resent. If a new triggering instruction is received within the expiry date, the vaccine frame is regenerated and sent.

9. The system according to claim 1, characterized in that, The anomaly detection engine is also used for: Continuously monitor the wireless network data packets of the target device to obtain new wireless network data packets; Determine whether the anomaly has disappeared based on the new wireless network data packets; If the vaccine frame does not disappear and the number of times it is sent exceeds a preset threshold, then the connection between the target device and the wireless network is disconnected.

10. A wireless network security detection method based on abnormal traffic, characterized in that, The method includes: The traffic acquisition and preprocessing module captures wireless network data packets of the target device in real time and extracts multi-dimensional traffic features from the wireless network data packets. The anomaly detection engine performs anomaly behavior analysis based on the multi-dimensional traffic characteristics to obtain initial anomaly alarms and corresponding anomaly degrees. The physical verification module collects real-time environmental data of the space where the target device is located based on the initial abnormal alarm, and cross-verifies the initial abnormal alarm based on the real-time environmental data to obtain verification conclusions. The active defense module determines the anomaly level of the target device based on the anomaly degree and the verification conclusion, and adjusts the defense mode of the target device based on the anomaly level.

Images